feat(rules): add service enforcement rules (#1982)

* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat(rules): add service enforcement rules Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
2026-08-25 16:07:24 +00:00 · 2026-06-24 11:20:23 +02:00
parent 7669abf063
commit 755cef54bf
63 changed files with 10168 additions and 1435 deletions
@@ -0,0 +1,78 @@
+// Copyright 2020-2026 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package rules
+
+import "github.com/projectcapsule/capsule/pkg/api"
+
+// +kubebuilder:object:generate=true
+type NamespaceRuleEnforceServicesBody struct {
+	// Types defines the Service types matched by this rule.
+	//
+	// Supported values:
+	// - ClusterIP
+	// - NodePort
+	// - LoadBalancer
+	// - ExternalName
+	//
+	// +optional
+	// +kubebuilder:validation:items:Enum=ClusterIP;NodePort;LoadBalancer;ExternalName
+	Types []ServiceType `json:"types,omitempty"`
+
+	// LoadBalancers defines additional constraints for Services of type LoadBalancer.
+	// +optional
+	LoadBalancers *ServiceLoadBalancerRule `json:"loadBalancers,omitempty"`
+
+	// ExternalNames defines additional constraints for Services of type ExternalName.
+	// +optional
+	ExternalNames *ServiceExternalNameRule `json:"externalNames,omitempty"`
+
+	// NodePorts defines additional constraints for nodePort values.
+	// +optional
+	NodePorts *ServiceNodePortRule `json:"nodePorts,omitempty"`
+}
+
+// +kubebuilder:validation:Enum=ClusterIP;NodePort;LoadBalancer;ExternalName
+type ServiceType string
+
+const (
+	ServiceTypeClusterIP    ServiceType = "ClusterIP"
+	ServiceTypeNodePort     ServiceType = "NodePort"
+	ServiceTypeLoadBalancer ServiceType = "LoadBalancer"
+	ServiceTypeExternalName ServiceType = "ExternalName"
+)
+
+// +kubebuilder:object:generate=true
+type ServiceLoadBalancerRule struct {
+	// CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
+	// Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
+	// +optional
+	CIDRs []string `json:"cidrs,omitempty"`
+}
+
+// +kubebuilder:object:generate=true
+type ServiceExternalNameRule struct {
+	// Hostnames restricts spec.externalName.
+	// Empty means no additional hostname restriction once ExternalName is allowed by types.
+	// +optional
+	Hostnames []api.ExpressionMatch `json:"hostnames,omitempty"`
+}
+
+// +kubebuilder:object:generate=true
+type ServiceNodePortRule struct {
+	// Ports restricts explicitly requested nodePort values.
+	// Empty means no additional port restriction once NodePort is allowed by types.
+	// +optional
+	Ports []ServiceNodePortRange `json:"ports,omitempty"`
+}
+
+// +kubebuilder:object:generate=true
+type ServiceNodePortRange struct {
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	From int32 `json:"from"`
+
+	// +kubebuilder:validation:Minimum=1
+	// +kubebuilder:validation:Maximum=65535
+	To int32 `json:"to"`
+}
@@ -14,4 +14,8 @@ type NamespaceRuleEnforceBody struct {

 	// Enforcement for Workloads (Pods)
 	Workloads NamespaceRuleEnforceWorkloadsBody `json:"workloads,omitempty"`
+
+	// Enforcement for Services.
+	// +optional
+	Services NamespaceRuleEnforceServicesBody `json:"services,omitempty"`
 }
@@ -63,6 +63,7 @@ func (in *NamespaceRuleBodyTenant) DeepCopy() *NamespaceRuleBodyTenant {
 func (in *NamespaceRuleEnforceBody) DeepCopyInto(out *NamespaceRuleEnforceBody) {
 	*out = *in
 	in.Workloads.DeepCopyInto(&out.Workloads)
+	in.Services.DeepCopyInto(&out.Services)
 }

 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRuleEnforceBody.
@@ -75,6 +76,41 @@ func (in *NamespaceRuleEnforceBody) DeepCopy() *NamespaceRuleEnforceBody {
 	return out
 }

+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *NamespaceRuleEnforceServicesBody) DeepCopyInto(out *NamespaceRuleEnforceServicesBody) {
+	*out = *in
+	if in.Types != nil {
+		in, out := &in.Types, &out.Types
+		*out = make([]ServiceType, len(*in))
+		copy(*out, *in)
+	}
+	if in.LoadBalancers != nil {
+		in, out := &in.LoadBalancers, &out.LoadBalancers
+		*out = new(ServiceLoadBalancerRule)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExternalNames != nil {
+		in, out := &in.ExternalNames, &out.ExternalNames
+		*out = new(ServiceExternalNameRule)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.NodePorts != nil {
+		in, out := &in.NodePorts, &out.NodePorts
+		*out = new(ServiceNodePortRule)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new NamespaceRuleEnforceServicesBody.
+func (in *NamespaceRuleEnforceServicesBody) DeepCopy() *NamespaceRuleEnforceServicesBody {
+	if in == nil {
+		return nil
+	}
+	out := new(NamespaceRuleEnforceServicesBody)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopyInto(out *NamespaceRuleEnforceWorkloadsBody) {
 	*out = *in
@@ -185,3 +221,80 @@ func (in *OCIRegistry) DeepCopy() *OCIRegistry {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceExternalNameRule) DeepCopyInto(out *ServiceExternalNameRule) {
+	*out = *in
+	if in.Hostnames != nil {
+		in, out := &in.Hostnames, &out.Hostnames
+		*out = make([]api.ExpressionMatch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceExternalNameRule.
+func (in *ServiceExternalNameRule) DeepCopy() *ServiceExternalNameRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceExternalNameRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceLoadBalancerRule) DeepCopyInto(out *ServiceLoadBalancerRule) {
+	*out = *in
+	if in.CIDRs != nil {
+		in, out := &in.CIDRs, &out.CIDRs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceLoadBalancerRule.
+func (in *ServiceLoadBalancerRule) DeepCopy() *ServiceLoadBalancerRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceLoadBalancerRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceNodePortRange) DeepCopyInto(out *ServiceNodePortRange) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceNodePortRange.
+func (in *ServiceNodePortRange) DeepCopy() *ServiceNodePortRange {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceNodePortRange)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ServiceNodePortRule) DeepCopyInto(out *ServiceNodePortRule) {
+	*out = *in
+	if in.Ports != nil {
+		in, out := &in.Ports, &out.Ports
+		*out = make([]ServiceNodePortRange, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ServiceNodePortRule.
+func (in *ServiceNodePortRule) DeepCopy() *ServiceNodePortRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ServiceNodePortRule)
+	in.DeepCopyInto(out)
+	return out
+}